+ lHjk.aR*t#0tRt^RIt^RIt^RIt^RIHt^RIH t ^RI H t H t H t ]P!R4tRRltRR ltR R lt!R R 4t]P(!RRR7t]^kRRltRRltRRltRRltRRltRRltRRltRRltR R!ltR"R#ltR$R%lt R&R'lt!R(R)lt"R#)+aWrite/delete guards for ``skill_manage``. Every guard returns ``None`` when the operation may proceed, else a refusal (error dict or message). Origin-owned state (``_find_skill``, ``_skills_dir``) is reached lazily via ``tools.skill_manager_tool`` so test patches keep working.N)suppressPath)AnyDictOptionalztools.skill_manager_toolc^V^8dQhR\R\R\\\3,/#)messageextrareturn)strrdict)formats"?/home/ubuntu/.hermes/hermes-agent/tools/skill_manager_guards.py __annotate__rs)99c9C9DcN9c RRRV/VC#)successFerror)r r s&,r_refusalrs ugw 8% 88rc$V^8dQhR\/#)r r )bool)rs"rrrstrcT^RIHp\V!44# \dR#i;i)zLTrue inside the autonomous curator review fork; False on any lookup failure.is_background_reviewF)tools.skill_provenancerr Exceptionrs r_is_background_reviewrs+?(*++ s  ''c0V^8dQhR\R\/#r pathr )rr )rs"rrrsrc\\4;_uu_4\VP44uuRRR4# +'giM;i\T4#N)rrr resolver"s&r _resolved_strr's4 )  4<<>"     t9s < A cZa]tRt^#toRtV3RlRltV3RlRltV3RlRltRtVt R #) _BackgroundReviewReadMarksz@Read marks shared by copied tool contexts within one review run.c<V^8dQhRR/#r r Nr)r __classdict__s"rr'_BackgroundReviewReadMarks.__annotate__&s&&$&rcX\P!4Vn\4VnR#r$) threadingLock_lockset_paths)selfs&r__init__#_BackgroundReviewReadMarks.__init__&s^^% # rc$<V^8dQhRS[RR/#r r"r N)r )rr,s"rrr-*s""""rcVP;_uu_4VPPV4RRR4R# +'giR#;ir$)r1r3addr4r"s&&rr:_BackgroundReviewReadMarks.add*s' ZZZ KKOOD !ZZZs ; A c&<V^8dQhRS[RS[/#r!)r r)rr,s"rrr-.s''S'T'rcVP;_uu_4WP9uuRRR4# +'giR#;ir$r1r3r;s&&rcontains#_BackgroundReviewReadMarks.contains.s! ZZZ;;&ZZZs. ? r?N) __name__ __module__ __qualname____firstlineno____doc__r5r:r@__static_attributes____classdictcell__)r,s@rr)r)#s&J&&""''rr)background_review_read_paths)defaultc(V^8dQhR\RR/#r8r)rs"rrr7s##D#T#rc\4'gR#\P4;pf \P\ 4;p4VP \ V44R#)zRecord that the active background-review fork has read a skill file. The fork must not patch content it only inferred from the transcript: skill_view/read_file call this, and the write guards require the mark.N)r_background_review_read_pathsgetr2r)r:r'r"markss& r!mark_background_review_skill_readrQ7sL ! " ".2244=%))3M3O*O%P IImD!"rc0V^8dQhR\R\/#r!rr)rs"rrrBsEEdEtErcv\P4pVRJ;'dVP\V44#r$)rMrNr@r'rOs& r_background_review_has_readrUBs1 ) - - /E   D D d0C!DDrcV^8dQhRR/#r+r)rs"rrrGsDDTDrc@\P\44R#)z@Start a fresh, isolated read set for the current review context.N)rMr2r)rrr#_reset_background_review_read_marksrXGs!%%&@&BCrc$V^8dQhR\/#)r skill_pathr)rs"rrrLs   rc$^RIHpVP4p.pV!4FCp\ \4;_uu_4VP WDP434RRR4KE W#3# \dTpLbi;i +'giKn;i)zZ``(resolved skill_path, [(root, resolved_root), ...])`` over every resolvable skills root.)get_all_skills_dirsN)agent.skill_utilsr\r%OSErrorrappend)rZr\resolvedrootsroots& r_resolved_rootsrcLs5%%' E#% g   LL$ / 0 & ?   sA+!A>+ A;:A;> B c0V^8dQhR\R\/#)r rZr r)rs"rrrZs____rcta^RIHp\V4wop\V3RlV4VP 44#)zXSkills root (local or external_dirs) containing ``skill_path``; local dir if none match.skill_manager_toolc3^<"TF"wrSPV4'gKVxK$ R#5ir$)is_relative_to).0rbrr`s& r *_containing_skills_root..^s"IU'$h.E.Ea.HUs- -)toolsrgrcnext _skills_dir)rZ_smtrar`s& @r_containing_skills_rootrrZs00%j1OHe IUI4K[K[K] ^^rc0V^8dQhR\R\/#r!rS)rs"rrrasDTrcVP4;'g%\VR4;'dVP4# \dR#i;i)u\Symlink or (Windows 3.12+) junction — either lets a poisoned tree redirect rmtree outside. is_junctionF) is_symlinkhasattrrur^r&s&r_is_path_redirectrxasF YYWT=%A%X%XdFVFVFXY s>>> A  A cFV^8dQhR\R\\,/#)r skill_dirr )rrr )rs"rrris"ddtd drc \V4'dRV R2#VP4\T4wr#TF-wrEY%8Xd RT R2u#TP T4'gK,R# RT R2# \dpRT RT R2uRp?#Rp?ii;i)aLast-line guard before rmtree: even a poisoned tree must never delete (1) a path outside every known skills root, (2) a skills root itself, (3) a symlink/junction (rmtree follows it). ``_find_skill`` already restricts ``skill_dir`` to a real ``SKILL.md`` parent discovered by walking the skills roots, so the agent cannot inject an arbitrary path the way Kilo Code's HTTP endpoint could (their issue 11227: a built-in-skill sentinel resolved to the server cwd and a recursive delete wiped the user's entire working directory). This is the matching defense-in-depth for our agent-facing ``skill_manage`` delete path: even if discovery or a poisoned tree hands us a bad directory, never recursively delete See #11227. zRefusing to delete 'zZ': the skill directory is a symlink/junction. Remove the link target manually if intended.z': could not resolve path (z).NzP': resolves to the skills root itself, which would remove every installed skill.z6': path does not resolve inside any known skills root.)rxr%r^rcri)rzexcr`ra_rootrbs& r_validate_delete_targetr~is##&yk2QR ST&i0OH   *9+6HI J  " "4 ( (  "),b cc T%i[0KC5PRSSTsA// B :BB B cRV^8dQhR\R\R\\,/#)r namewhatr )r rr)rs"rrrs%Src^RIHp\VPV4P R44# \ d\ PRYRR7R#i;i)zNskill_usage pinned flag; None (logged at debug) when the record is unreadable. skill_usagepinnedz%s lookup failed for %sTexc_infoN)rnrr get_recordrNrloggerdebug)rrrs&& r _is_pinnedrsP%K**4044X>??  .T Js.1#AAcFV^8dQhR\R\\,/#)r rr )r r)rs"rrrs rc^RIHpW9dRV R2#\ VR4'd RV RV R 2#R # \d\P RTRR7LBi;i) zRefusal message if *name* is pinned or essential, else None. Pin only guards DELETION; patches/edits stay allowed. ESSENTIAL_SKILLS are permanently pinned (the system prompt references them). Best-effort: an unreadable sidecar lets the delete through.)ESSENTIAL_SKILLSzSkill 'z' is essential to Hermes (the agent's own operating manual referenced by the system prompt) and cannot be deleted. Patches and edits are still allowed.z$essential-guard lookup failed for %sTrz pinned-guardz]' is pinned and cannot be deleted by skill_manage. Ask the user to run `hermes curator unpin zf` if they want to delete it. Patches and edits are allowed on pinned skills; only deletion is blocked.N)r]rrrrr)rrs& r _pinned_guardrsR6  #$ JK L $$''dV))-/F G H  R ;TD QRs2#AAc tV^8dQhR\R\R\\\\3,,/#)r rrzr r rrrr)rs"rrrs1,,#,$,8DQTVYQYNC[,rc >\4'gR#Rp\VR4'd\V RV RV R24#^RIHpV!V4'd\V RV R 24#^R IH pVPR3VPR3VPR33F)wrVV!V4'gK\V RV RV R24u# VP4PV4pVPV4'gE\!V\"4'dRVPR4: 2MRp\V RV RV RV R24#R# \ d\ PR TR R 7Li;i \ d-\ P%RTR R 7\T RT R24u#i;i)a Refuse autonomous deletes of anything but curator-owned sediment. Content writes are not gated by ownership: the review fork exists to improve every skill it learns from, and every write is ledgered and reversible, while an archive removes a skill the user relies on.Nz&Refusing background curator delete forzpinned skill guardz pinned skill 'ze': pinned skills are off-limits to autonomous maintenance. Ask the user to run `hermes curator unpin z` if they want it changed.)is_external_skill_pathz skill 'zl': the skill lives in skills.external_dirs, which are externally owned and read-only to autonomous curation.z)external skill guard lookup failed for %sTrrzprotected built-inz hub-installedbundled z'.z created_by= created_byzno usage recordz%': the skill is not curator-managed (zW). Only curator-managed skills may be archived autonomously. Run `hermes curator adopt z` to opt it in.z&owned skill guard lookup failed for %szd': agent ownership could not be verified because the provenance record is unavailable or unreadable.)rrrr]rrrrrnris_protected_builtinis_hub_installed is_bundled load_usagerN_is_curator_managed_record isinstancerwarning) rrzrefuserr predicatelabel usage_rec_details && r_background_review_delete_guardrs ! " " 5F$,--hodV,F4 67 7W< !) , ,((4&)IJK K - X%  - -/C D  ) )? ;  # #Y /!1 I6(!E7(4& CDD !1 **,006 55i@@HRS\^bHcHcY]]<%@$CD- ((4&)$$+9-;;?&QR RA 5 W @$QU VW* X?PTUhhtf%V WX XXs<D<D<#?E%'E%=7E%5AE%<#E"!E"%4FFc V^8dQhR\R\R\R\R\\\\3,,/#)r rtargetaction file_labelr r)rs"rrrsB * *  * *%( *69 *>FtCQTH~>V *rc v\4'd\V4'dR#\RV RV RV R2RR7#)zARequire review forks to load the exact target before mutating it.NzRefusing background curator z for skill 'z': the current z content has not been loaded in this review turn. Call skill_view(name) for SKILL.md, or skill_view(name, file_path=...) for a supporting file, then retry the write using the content just returned.T)_read_before_write_required)rrUr)rrrrs&&&&r*_background_review_read_before_write_guardrsL ! " "&A&&I&I  &vhl4&PZ|\! "%)  **rc tV^8dQhR\R\R\\\\3,,/#)r rrr r rrr)rs"rrrs3YYYCYHT#s(^`` (existence validated in ``_delete_skill``); the deterministic inactivity prune never calls skill_manage, so a bare delete here can only be the LLM pass pruning without evidence. A delete with no forwarding target — ``absorbed_into`` omitted (``None``) or empty (``""``) — is the fail-open behavior reported in #29912: the consolidation pass archived whole clusters of active skills with zero verified consolidations (``consolidated_this_run == 0``), leaving active automations pointing at names that no longer resolve. Refuse it; keep the skill active. Nz-Refusing background curator delete of skill 'uP': the consolidation pass may only archive a skill it has absorbed into an umbrella. Pass absorbed_into= (the umbrella must already exist) to record a verified consolidation. Pruning a skill with no forwarding target is not permitted here — the deterministic inactivity prune handles staleness archival separately. Keeping 'z ' active.T) _fail_closed)rrr stripr)rrs&&r#_curator_consolidation_delete_guardrsW ! " "z-'E'E-J]J]J_J_  7v>348&  C   rcV^8dQh/^\9d*\P\\,,;R&#)r rM)__conditional_annotations___ctxvars ContextVarrr))rs"rrrs8!!dGGx228rs! &&   5 69 ' '" 6EG#E D _d8*,^ *Yr